Expat went C99 coding style in one file and doesn't build on VC versions below 12 which is why the difference. That said, Expat version 2.2.3 was a security release fixing CVE-2017-11742 DLL hijacking vulnerability in Windows and 2.2.4 just has one other minor bug fix.

That is a commit 3 days after release R_2_2_4. Not exactly '2.2.4 current master'. You'd better describe it as current master with the commit at the moment of building 2.4.28. Now we do not know which libexpat commits were included. Most likely you used libexpat master as of 16 Sep 2017, up until commit 177eb6b

Release 2.2.5 ???????????????????
Bug fixes:
#8 If the parser runs out of memory, make sure its internal
state reflects the memory it actually has, not the memory
it wanted to have.
#11 The default handler wasn't being called when it should for
a SYSTEM or PUBLIC doctype if an entity declaration handler
was registered.
#137 #138 Fix a case of mistakenly reported parsing success where
XML_StopParser was called from an element handler